AI Security

Korean police: ex-pentester used ARTEX AI to steal 8.2m records

Seoul police say a former pentester used the ARTEX AI attack framework to breach 90+ organisations and steal 8.2m records. What it means for UK firms.

Illustration of an AI network symbol representing an AI-driven hacking framework

South Korean police say a former penetration tester used ARTEX, an openly published AI attack framework, to break into more than 90 organisations and take around 8.2 million records. It is one of the clearest cases yet of a small criminal crew using agentic AI to hack at an industrial scale, and UK defenders should study it closely.

What happened

The Seoul Metropolitan Police have referred a 32-year-old man to prosecutors as the alleged leader of a seven-person group that compromised more than 90 South Korean organisations. The victims include schools and education providers, hospitals, large companies and golf courses. BleepingComputer reported the case on 26 October 2026, citing police and Yonhap. Investigators put the haul at about 8.2 million records. In 38 of the incidents the group allegedly sent extortion demands of 360 million won, about $270,000 according to BleepingComputer, in return for not publishing the data.

According to the police account, the suspect worked at a security company between 2019 and 2022 and has a penetration testing background. Yonhap described him as self-taught. He allegedly started attacking organisations in September 2025 with ordinary tooling, then added AI utilities in late August 2026, mostly the ARTEX framework. A victim complained in June, and detectives worked back to the group through server logs held by the breached organisations. He was arrested on 15 October, formally detained two days later and handed to prosecutors on 23 October. The other six suspects are being investigated but are not in custody.

Police called it the first arrest in Korea for large-scale hacking and theft of personal data that relied on generative AI. They said the technology has “lowered the barrier to entry” for would-be criminals. Officers are now checking whether the data has surfaced on the dark web.

The technical picture

ARTEX was published on GitHub as an open-source autonomous penetration testing console aimed at Chinese-speaking users. It drives large language models to do the work a human tester would normally do: reconnaissance, searching for vulnerabilities, planning a route through the target, running existing security tools and confirming that a weakness is real. The operator chooses a target and a goal, and the framework hands each step to one or more AI agents.

On 2 October, Moon Jong-hyun, head of research at Genians, flagged ARTEX console page titles on servers tied to the Shinhan Bank breach, though only as circumstantial evidence. Yonhap then reported that AhnLab had found ARTEX hosted on roughly 600 IP addresses worldwide, although hosting alone does not prove each was used in attacks. On 10 October, BleepingComputer reported that CrowdStrike had confirmed ARTEX had been used against Korean banks, with DeepSeek as the main model and GLM and Grok used alongside Claude Code sessions. Separately, Microsoft linked the tool to the China-aligned Storm-0940 campaign against ConnectWise customers.

The design point that matters most is how ARTEX splits work. Yusuke Matsumoto, a senior consultant at a Japanese consultancy, argued in Nikkei (as relayed by Kyongbuk Maeil) that because ARTEX breaks a campaign into small tasks for different models, no single model sees the full attacking intent. A model built to refuse harmful requests may happily complete one innocent-looking fragment of a much larger intrusion. The developer withdrew the public project in early October, but by then, according to The Telegraph, more than 12,000 people had copied the code. Matsumoto also said modified variants specialising in remote access and reconnaissance are already being built.

Timeline of the ARTEX AI hacking case from first attacks in September 2025 to referral to prosecutors on 23 October 2026

Why it matters for UK organisations

This is not a story about a nation state. By the police’s account it is a small crew led by one person with a few years of commercial testing experience. Agentic tooling appears to have given them the reach of a much larger operation. The victim list is what UK readers should notice: schools, hospitals, large companies and golf courses. These are not hardened banks. They are the kind of organisations that make up most of the UK economy and most of its breach statistics.

The economics have shifted. Before, an attacker had to pick targets carefully because each intrusion cost skilled time. An agent that scans, chooses an attack path and validates exploits without supervision makes it cheap to try hundreds of targets at once and simply follow up the ones that give way. UK firms that relied on being “not interesting enough” lose that cover: they only have to be reachable and weak.

There is a data protection angle too. Extortion without encryption, where the threat is to leak rather than lock, still counts as a personal data breach under UK GDPR. It still starts the 72-hour clock for reporting to the ICO when there is a risk to individuals.

Expert view

When we run internal and external tests, most of the findings that lead to real compromise are not exotic. They are exposed admin panels, default or reused credentials, unpatched internet-facing applications and flat networks. An agentic framework does not need to invent new attacks to be dangerous. It needs to find those ordinary weaknesses faster and more tirelessly than a person can, and that is exactly what ARTEX was built to do.

In my experience, the gap between a vulnerability scan and a working compromise has always been the human effort of chaining issues together. That effort is what is being automated here, and it is why I would treat this case as a warning rather than a curiosity. I would not put much faith in model-level guardrails either: splitting tasks across several models, some reached through resellers, can sidestep them.

The encouraging part is how the case was solved. Server logs at the victims led police to the suspects. Good logging, kept for long enough and actually reviewed, remains one of the cheapest controls an organisation can have.

What to do now

  1. Shrink your attack surface. List every internet-facing service, including forgotten test systems and vendor portals, and remove or restrict anything that does not need to be public. This maps to the Cyber Essentials firewalls control.
  2. Patch exposed systems on a short clock. Agents can find known flaws within hours, so apply critical and high-severity fixes to internet-facing software within 14 days at most, and faster where you can (security update management).
  3. Kill weak and default credentials. Enforce multi-factor authentication on remote access, email and admin interfaces, and audit for shared or reused passwords (user access control and secure configuration).
  4. Keep and watch your logs. Make sure web, VPN and authentication logs are kept centrally for at least 90 days, with alerts for bulk data access and unusual outbound transfers.
  5. Test like the attacker now does. Commission external testing that includes automated, high-volume reconnaissance, and run breach-and-extortion scenarios that cover ICO reporting.
  6. Govern your own AI testing tools. If your teams use open-source agentic pentest frameworks, check where they came from, isolate them and log what they do.

Bottom line

A small crew led by an experienced tester allegedly breached more than 90 organisations in about a year, and turned to an open-source AI framework to widen the attacks. UK organisations, especially smaller ones, should assume this level of automated attack is already aimed at them, and close the basic gaps it depends on.

Sources

Related Posts